Five Questions to Ask Before January 10, 2014 Courtney H. Gilmer, 615.726.5747, cgilmer@bakerdonelson.com 1. Compliance Procedures. Have you updated your written policies and procedures for each of your products or services to encompass the new rules and regulations? Once updated, have you provided copies to your employees? Have your provided training to your employees (both compliance department and front-line) on the new regulations and on any software updates required as a result of the new rules? 2. Updated Consumer Complaint Process. Have you established channels for consumer complaints to reach the correct department, set out mechanisms to ensure prompt resolution of complaints, and have a process for recording and categorizing the complaints and inquiries? It is expected that CFPB audits will include a review of records of complaints received along with corresponding information regarding the resolution of the complaints. 3. Third Party and Vendor Management. Have you reviewed your arrangements or contracts with vendors and third parties related to mortgage products and servicing? Do you plan to review complaints regarding vendor activity for compliance and process concerns? 4. Qualified Mortgage Provisions. Do your policies and procedures encompass the new components for qualified mortgages, including documentation of loan eligibility for purchase by Fannie Mae or Freddie Mac or insurable by FHA 5. Mortgage Servicing Rules. Have you updated your policies and procedures to address key aspects of the mortgage servicing provisions, including periodic billing statements, prompt payment crediting, force-placed insurance rules, and error resolution and information requests? In re JPMorgan Chase Bank, N.A.; and Chase Bank USA, N.A. John Barnes, 713.210.7441, jbarnes@bakerdonelson.com The Consumer Financial Protection Bureau (CFPB) brought an enforcement action against JPMorgan Chase Bank, N.A. and Chase Bank USA, N.A. (collectively, the Bank), pursuant to 12 U.S.C. 5563 and 5565 with regard to their billing and administration of identity protection products. Specifically, it alleged that the Bank had billed customers for credit monitoring and credit protection services that were not, in fact, provided. The Bank agreed to the issuance of a consent order, pursuant to which the Bank agreed to (a) design and implement various policies and procedures to correct the issue, and to not market any identity protection products until such policies and procedures have been submitted to and approved by the CFPB; (b) make restitution of all amounts illegally charged; and (c) pay a civil monetary penalty of $20 million to the CFPB. 1
In re JPMorgan Chase Bank, N.A.; and Chase Bank USA, N.A., continued Findings From October 2005 to March 2012, the Bank and its vendors marketed, offered for sale and sold identity protection products that purported to monitor customers credit information in order to alert them to activity that would indicate identity theft or other fraudulent use of their financial information. The Bank represented that, in exchange for a monthly fee, the Bank and/or its vendors would provide features that included a product named 3-CFPB Credit Monitoring. This product was to provide daily monitoring of customers information at three credit reporting agencies to identify and alert customers to activity that could suggest fraudulent use of their identities. These products were sold as add-on features to new or existing credit card accounts, as well as to retail bank customers and non-customers. Once the customer was enrolled in the program, the servicing of the identity protection product was delegated by the Bank to Corelogic, Inc. Corelogic was formerly known as First Advantage Membership Services, Inc. for Chase Fraud Detector, True Credit for the Chase Identity Protection, and Intersections, Inc. for Chase Identity Protection. Pursuant to the Fair Credit Reporting Act (FCRA), Corelogic provided customers with the materials necessary to grant it authorization to access their credit information from the reporting agencies in order to activate 3-CFPB Credit Monitoring. In many cases, however, the CFPB found that some period of time passed before customers provided authorization, or that Corelogic never obtained the authorization. In still other cases, customers provided authorization, but one or more credit reporting agencies would not process it for various reasons. These issues were not caught by the Bank s compliance monitoring, service provider management or quality assurance methodologies. As a result, though the Bank and Corelogic were unable to activate the 3-CFPB Credit Monitoring, those customers were nonetheless billed for those services that were not provided. The pool of customers affected by this error exceeded 2.1 million customers, who were billed least $270 million in fees and over-limit charges, as well as more than $39 million in associated interest fees. Resolution The Bank and the CFPB agreed to the issuance of a consent order, pursuant to which the Bank was ordered to do the following: Cease and Desist The Bank is barred from marketing, soliciting, offering for sale and selling its Chase Identity Protection and Chase Fraud Detector products, until such time as it submits a Compliance Plan to the CFPB. Action Plan On or before December 18, 2013, the Bank was to submit an Action Plan to the CFPB to address the actions necessary and appropriate to achieve compliance with the order, including the development or revision of a written Vendor Management Policy, which must require (a) a written contract between the Bank and its vendor, setting forth the rights and responsibilities of each with respect to the identity protection products; (b) an analysis to be conducted by the Bank prior to contracting with a vendor for services related to the identity protection products; and (c) periodic onsite review by the Bank of the vendors controls, performance and information systems. 2
In re JPMorgan Chase Bank, N.A.; and Chase Bank USA, N.A., continued Unfair, Deceptive or Abusive Acts or Practices (UDAAP) Policy On or before December 18, 2013, an appropriate independent qualified group within the Bank must develop a UDAAP policy for any add-on products, that shall require: Annual written review of any changes to policies and procedures affecting add-on products considered to be high risk for UDAAP, as well as of any new products considered to be at high risk for UDAAP. Recording of all telephone marketing or sales calls by either the Bank or the vendor, with the recordings to be retained for a period of at least 25 months from the date of the call. Recording of all telephone calls by either the Bank or the vendor with enrolled customers in which the customer indicates that he or she did not authorize, does not want or need, or wishes to cancel the product, with the recordings to be retained for a period of at least 25 months from the date of the call. Comprehensive written procedures for training Bank employees and vendor call agents on applicable Federal consumer financial laws and the Bank s policies and procedures regarding telephone calls with customers regarding the products, as well as for Bank and vendor employees who monitor such calls. Comprehensive written policies and procedures for identifying and reporting violations of applicable Federal consumer financial laws and the Bank s policies and procedures, by the Bank s employees and vendor s employees or agents, in a timely manner. Independent call monitoring by qualified personnel. Written policies and procedures to ensure that the risk management, internal audit and corporate compliance programs have the requisite authority and status within the Bank to identify and remedy deficiencies. Consumer Compliance Internal Audit Program On or before December 18, 2013, the Bank was to develop and submit a written internal audit compliance program to the CFPB Regional Director, which must include: Written policies and procedures for conducting audits of the Bank s compliance with applicable Federal consumer financial laws. Written policies and procedures for expanding the sampling of the internal audit when exceptions based on potential violations are detected. Redress On or before November 18, 2013, the Bank was required to develop a redress plan for making full restitution to all affected customers of all monthly fees paid for the identity protection products, all over-limit fees paid due to the charging of the monthly fees, and all finance charges accrued on the monthly fees, minus any redress already made, and submit it to the Regional Director for review and non-objection. Civil Monetary Penalty On or before September 29, 2013, the Bank was to pay a civil fine in the amount of $20 million to the CFPB, with such penalty not to be treated as an offset, deduction or credit against any federal, state or local tax or fine, or against any court judgment. The Bank is also barred from seeking indemnity from any applicable policy of insurance to recoup this amount. 3
In re JPMorgan Chase Bank, N.A.; and Chase Bank USA, N.A., continued Why This Matters The significance of both this enforcement action and the manner of its resolution is that they highlight the scope of liability and increased scrutiny that the CFPB intends to apply to consumer credit products. In particular, going forward, the CFPB clearly expects a high degree of transparency as to consumer communications with banks and their third-party vendors regarding credit protection and other add-on products, holding banks more to account for the acts and omissions of those vendors, and contemplates a much closer, almost hand-in-glove, relationship between the CFPB s regional directors and the banks that they supervise. The regime mandated by the consent order seeks a much less flexible, more extensive internal and external compliance structure for banks and mortgage servicers, coupled with more rigorous record-keeping and record-retention formulae for communications with customers. This also appears to assume and require a relatively high degree of compliance training for everyone from the call agent on through the ranks who is in any way involved with marketing, selling or servicing credit protection products. All told, if this action is emblematic of the future relationship between the CFPB and regulated financial institutions, it represents a paradigm shift in how the financial industry operates, and predictably will result in markedly increased overhead. New Risks for Payday Lenders Under Dodd-Frank Ned Hildebrand, 615.726.5706, nhildebrand@bakerdonelson.com The Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank) imposes sweeping regulations on nearly all aspects of consumer lending. In addition to establishing these new rules, Dodd-Frank also created the Consumer Financial Protection Bureau (CFPB) to enforce them. While most of the CFPB s regulatory authority applies to all consumer lenders, certain provisions apply only to specific types of non-depository creditors, including payday lenders. The result is the CFPB s new power to regulate payday lenders, as well as the ability to levy substantial penalties on those who violate federal consumer financial law. Payday lenders need to become familiar with the new regulations in order to implement procedures to protect themselves. The CFPB s Regulatory Power Over Payday Lenders Under Dodd-Frank, the CFPB has been granted the authority to punish any unfair, deceptive or abusive act or practice by a seller of a consumer financial product. Dodd-Frank broadly defines an abusive act or practice as one that: 1. Materially interferes with the ability of a consumer to understand a consumer financial product or service, or 4
New Risks for Payday Lenders Under Dodd-Frank, continued 2. Takes unreasonable advantage of: a. A consumer s lack of understanding of the material risks of the product. b. The consumer s inability to protect his or her own interest in using the product. c. The consumer s reasonable reliance that the provider of the product would act in the interest of the consumer. The CFPB s examinations procedures for the payday lending industry suggest several ways in which payday lenders may violate this standard, including a lender s failure to disclose check cashing fees, material terms of a financial product or the consumer s rights regarding payment. Because of Dodd-Frank s all-encompassing definition of abusive acts, payday lenders will likely face increased scrutiny over their products. Such lenders should create procedures to ensure compliance with these disclosure requirements. The CFPB s Supervisory Power over Payday Lenders To help the CFPB investigate and identify suspected violations of federal consumer financial law, Dodd-Frank gives the CFPB broad supervisory powers over payday lenders. Under Dodd-Frank, the CFPB is required to collect reports and conduct examinations of payday lenders for the purpose of (1) ensuring compliance with federal law, (2) obtaining information about the payday lender s procedures to prevent violations, and (3) detecting risks to consumers created by the products offered by payday lenders. In addition, the CFPB can create rules requiring payday lenders to generate, provide or retain records to assist in the supervision. The CFPB even has the authority to impose background checks on principals, officers, directors and other personnel of the payday lender to ensure that such lenders are legitimate entities. Failure to respond to the CFPB s request for information can result in a court order for contempt. The CFPB s Enforcement Power over Payday Lenders The CFPB s role does not end at supervision; if it detects a violation of federal consumer financial law, it has the power to impose substantial penalties on the offender. The CFPB generally has two levels of enforcement power: cease and desist orders and civil penalties. If the CFPB discovers a violation, it may send a letter ordering the suspected offender to cease and desist the offending behavior. If the suspected offender does not respond within 30 days, the order automatically becomes effective. The CFPB also has the authority to bring a civil action against a suspected offender in the District Court of the district where the offender is located. Damages may include restitution, payment of damages, return of money or property, and public notification regarding the violation. In addition, the Act also imposes substantial civil penalties for violations of federal consumer financial law. These penalties are as follows: 1. For any violation, a fine of up to $5,000 for each day that such violation continues. 2. For a reckless violation, a fine of up to $25,000 for each day that such violation continues. 3. For a knowing violation, a fine of up to $1,000,000 for each day that such violation continues. 5
New Risks for Payday Lenders Under Dodd-Frank, continued Conclusion The CFPB will undoubtedly attempt to snare payday lenders under the expansive abusive acts and practices prohibition. If it finds evidence of such practices, or any other violation of consumer financial law, it will impose substantial penalties that most small, non-traditional lenders cannot afford to pay. Payday lenders should implement procedures, such as periodic monitoring reviews by management or a regular independent compliance audit, to ensure that they are making the necessary disclosures, preserving all loan documentation and minimizing the risk of violating these new regulations. New Servicing Guidelines Going Into Effect January 10, 2014 Dylan W. Howard, 404.589.3406, dhoward@bakerdonelson.com The new Consumer Financial Protection Bureau (CFPB) servicing rules effective January 10, 2014 will change the legal landscape for mortgage servicers tremendously. Servicers now have very little time to accommodate the new rules. These changes begin with the early intervention rules put in place by the CFPB. As of January 10, 2013, when a borrower defaults, a servicer must make a good faith effort to establish contact with the borrower by 36th day of their delinquency. If the borrower s default continues after the attempted contact, the contact must be made for each delinquent payment, though written notice of the delinquency is required once every 180 days. Next, the servicer must provide the delinquent borrower with written notice specifying the available loss mitigation options, if available, by the 45th day of delinquency. There is an exemption in these rules for small servicers, for borrowers in bankruptcy, and for debt collectors where a borrower has exercised his right to demand that communications cease. The next set of rule changes involve what the CFPB terms continuity of contact. For all delinquent borrowers, the loan servicer must maintain reasonable policies to provide delinquent borrowers with access to personnel to assist with their loss mitigation efforts. Servicers must assign specific personnel to the delinquent borrower by the time the servicer provides written notice of loss mitigation options. The specified personnel should be accessible to the borrower by phone and should be able to advise the borrower on the status of any loss mitigation application, access all of the information provided by the borrower, and provide that information to those responsible for evaluating the borrower for loss mitigation options. Small servicers are exempt from these rules. Fortunately, the CFPB has stated that it will supervise servicers for compliance with the continuity of contact rules and that borrowers will not maintain a private right of action arising from the violation of these rules. 6
New Servicing Guidelines Going Into Effect January 10, 2014, continued There also are substantial changes to the rules that govern a servicer s review of a borrower for loss mitigation options. Basically, if a borrower submits a loss mitigation application more than 45 days prior to foreclosure, the servicer must acknowledge receipt of the application in writing within five days, and must either tell the borrower that the application is complete or, if it is incomplete, must tell the borrower what information is needed to complete it. If additional information or documentation is necessary, the servicer must provide the borrower with a reasonable date by which the missing information should be submitted. The CFPB has declared that it would be impractical for a borrower to obtain and submit financial documentation in less than seven days. Then, if a complete loss mitigation application is received more than 37 days before a foreclosure sale, the servicer must evaluate the borrower within 30 days for all loss mitigation options available under investors eligibility rules, including retention and non-retention options. The servicer must then provide a written decision including explanations for any denial. If, on the other hand, loss mitigation is granted, the notice must specify the time and procedures for the borrower to accept or reject the servicer s offer. If the borrower does not respond within the appropriate time, the servicer may deem the borrower to have rejected the loss mitigation offer. If the borrower does not accept the offer formally but instead begins making payments in accordance with the offer by the deadline, the servicer must give the borrower a reasonable opportunity to complete the documentation necessary. Next, the borrower may appeal the decision so long as the completed loss mitigation application is received 90 days or more before foreclosure sale. If the borrower is eligible to appeal, the denial notice must give the deadline for appealing and describe any requirements for making the appeal. Finally, the CFPB rules bar dual tracking. If a complete loan application is submitted before the servicer has made the first notice or filing required for foreclosure, the servicer may not initiate foreclosure until: (a) it informs the borrower that the borrower is not eligible for loss mitigation options and any appeal has been exhausted; (b) the borrower rejects all loss mitigation offers, or (c) the borrower fails to comply with the terms of the loss mitigation option that was offered. If the borrower submits a complete application after the foreclosure process commenced, but more than 37 days before sale, the servicer may not move for foreclosure judgment or conduct a sale until one of the same three conditions has been satisfied. While small servicers are exempted from these rules, please be aware that borrowers will have a private right of action. ALABAMA FLORIDA GEORGIA LOUISIANA MISSISSIPPI TENNESSEE TEXAS WASHINGTON, D.C. www.bakerdonelson.com The Rules of Professional Conduct of the various states where our offices are located require the following language: THIS IS AN ADVERTISEMENT. Ben Adams is Chairman and CEO of Baker Donelson and is located in our Memphis office, 165 Madison Avenue, Suite 2000, Memphis, TN 38103. Phone 901.526.2000. No representation is made that the quality of the legal services to be performed is greater than the quality of legal services performed by other lawyers. FREE BACKGROUND INFORMATION AVAILABLE UPON REQUEST. 2014 Baker, Donelson, Bearman, Caldwell & Berkowitz, PC 7